Vaultwarden - Revision history

LukESC: mention agenix as a secrets management solution

2026-09-05T17:11:52Z

mention agenix as a secrets management solution

← Older revision		Revision as of 17:11, 5 September 2026
Line 7:		Line 7:
	backupDir = "/var/local/vaultwarden/backup";		backupDir = "/var/local/vaultwarden/backup";
	# in order to avoid having ADMIN_TOKEN in the nix store it can be also set with the help of an environment file		# in order to avoid having ADMIN_TOKEN in the nix store it can be also set with the help of an environment file
	# be aware that this file must be created by hand (or via secrets management like sops)		# be aware that this file must be created by hand (or via secrets management like sops or agenix)
	environmentFile = "/var/lib/vaultwarden/vaultwarden.env";		environmentFile = "/var/lib/vaultwarden/vaultwarden.env";
	config = {		config = {

2026-08-30T11:37:49Z

Add postgresql support example

@@ Line 1: / Line 1: @@
 [https://github.com/dani-garcia/vaultwarden Vaultwarden] is an alternative server implementation of the Bitwarden Client API, written in [[Rust]] and compatible with [https://bitwarden.com/download/ official Bitwarden clients], allowing you to self-host your own password manager backend.
-== Example Configuration ==
+== Example Configuration with SQlite ==
 <syntaxhighlight lang="nix">
 services.vaultwarden = {
@@ Line 32: / Line 32: @@
 </syntaxhighlight>
-== Reverse Proxy Setup (recommended) ==
+== Example Configuration with Postgresql (recommended for production) ==
 === Caddy ===
 <syntaxhighlight lang="nix">services.caddy.virtualHosts."bitwarden.example.com".extraConfig = ''
@@ Line 53: / Line 91: @@
 </syntaxhighlight>
 [[Category:Server]]
 [[Category:Security]]
 [[Category:Rust]]

2026-06-10T12:51:50Z

fix nginx config typo

← Older revision		Revision as of 12:51, 10 June 2026
Line 42:		Line 42:
	'';</syntaxhighlight>		'';</syntaxhighlight>
	=== Nginx ===		=== Nginx ===
	<~~syntaxHighlight~~ lang=nix>		<syntaxhighlight lang="nix">
	services.nginx.virtualHosts."bitwarden.example.com" = {		services.nginx.virtualHosts."bitwarden.example.com" = {
	enableACME = true;		enableACME = true;
Line 48:		Line 48:
	locations."/" = {		locations."/" = {
	proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";		proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
	~~proxyWebSockets~~ = true;		proxyWebsockets = true;
	};		};
	};		};
	</~~syntaxHighlight~~>		</syntaxhighlight>

2026-05-05T16:51:15Z

Fix copy-paste error in nginx config

2026-05-05T16:50:18Z

Update SMTP environment names to match newest version. Proxy websockets

← Older revision		Revision as of 16:50, 5 May 2026
Line 24:		Line 24:
	SMTP_HOST = "127.0.0.1";		SMTP_HOST = "127.0.0.1";
	SMTP_PORT = 25;		SMTP_PORT = 25;
	~~SMTP_SSL~~ = ~~false~~;		SMTP_SECURITY = off;

	SMTP_FROM = "admin@bitwarden.example.com";		SMTP_FROM = "admin@bitwarden.example.com";
Line 48:		Line 48:
	locations."/" = {		locations."/" = {
	proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";		proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
			proxyWebSockets = true;
	};		};
	};		};

2025-12-16T06:45:15Z

add semicolon

← Older revision		Revision as of 06:45, 16 December 2025
Line 8:		Line 8:
	# in order to avoid having ADMIN_TOKEN in the nix store it can be also set with the help of an environment file		# in order to avoid having ADMIN_TOKEN in the nix store it can be also set with the help of an environment file
	# be aware that this file must be created by hand (or via secrets management like sops)		# be aware that this file must be created by hand (or via secrets management like sops)
	environmentFile = "/var/lib/vaultwarden/vaultwarden.env"		environmentFile = "/var/lib/vaultwarden/vaultwarden.env";
	config = {		config = {
	# Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template		# Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template

2025-10-22T13:28:07Z

backup folder in the /var/lib/vaultwarden directory would reference itself and is therefore not allowed

← Older revision		Revision as of 13:28, 22 October 2025
Line 5:		Line 5:
	services.vaultwarden = {		services.vaultwarden = {
	enable = true;		enable = true;
	backupDir = "/var/~~lib~~/vaultwarden/backup";		backupDir = "/var/local/vaultwarden/backup";
	# in order to avoid having ADMIN_TOKEN in the nix store it can be also set with the help of an environment file		# in order to avoid having ADMIN_TOKEN in the nix store it can be also set with the help of an environment file
	# be aware that this file must be created by hand (or via secrets management like sops)		# be aware that this file must be created by hand (or via secrets management like sops)

2025-08-17T13:37:43Z

2025-08-08T08:24:57Z

← Older revision		Revision as of 08:24, 8 August 2025
Line 6:		Line 6:
	enable = true;		enable = true;
	backupDir = "/var/lib/vaultwarden/backup";		backupDir = "/var/lib/vaultwarden/backup";
			# in order to avoid having ADMIN_TOKEN in the nix store it can be also set with the help of an environment file
			# be aware that this file must be created by hand (or via secrets management like sops)
			environmentFile = "/var/lib/vaultwarden/vaultwarden.env"
	config = {		config = {
	# Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template		# Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template
	DOMAIN = "https://bitwarden.example.com";		DOMAIN = "https://bitwarden.example.com";
	SIGNUPS_ALLOWED = false;		SIGNUPS_ALLOWED = false;
	~~# Needed to enable admin page and signups set ADMIN_TOKEN~~
	~~environmentFile = "/var/lib/vaultwarden/vaultwarden.env"~~

	ROCKET_ADDRESS = "127.0.0.1";		ROCKET_ADDRESS = "127.0.0.1";
	ROCKET_PORT = 8222;		ROCKET_PORT = 8222;

2025-08-08T07:00:20Z

added environmentfile variable as its needed for admin page and account setup.

← Older revision		Revision as of 07:00, 8 August 2025
Line 2:		Line 2:

	== Example Configuration ==		== Example Configuration ==
	<~~syntaxHighlight~~ lang=nix>		<syntaxhighlight lang="nix">
	services.vaultwarden = {		services.vaultwarden = {
	enable = true;		enable = true;
Line 10:		Line 10:
	DOMAIN = "https://bitwarden.example.com";		DOMAIN = "https://bitwarden.example.com";
	SIGNUPS_ALLOWED = false;		SIGNUPS_ALLOWED = false;
			# Needed to enable admin page and signups set ADMIN_TOKEN
			environmentFile = "/var/lib/vaultwarden/vaultwarden.env"

	ROCKET_ADDRESS = "127.0.0.1";		ROCKET_ADDRESS = "127.0.0.1";
Line 27:		Line 29:
	};		};
	};		};
	</~~syntaxHighlight~~>		</syntaxhighlight>

	== Reverse Proxy Setup (recommended) ==		== Reverse Proxy Setup (recommended) ==